https://community.splunk.com/t5/Deployment-Architecture/How-does-Splunk-forwarder-handle-data-after-uninstalling-and/m-p/281969#M10694 <P>The "file pointer" that tracks how far Splunk has read the input file is stored in the "fishbucket." The fishbucket is stored with the indexes. Unless you have deleted or reset the fishbucket in some way, the forwarder should pick up where it left off in processing the input.</P> Tue, 12 Apr 2016 17:34:59 GMT lguinn2 2016-04-12T17:34:59Z https://community.splunk.com/t5/Deployment-Architecture/How-does-Splunk-forwarder-handle-data-after-uninstalling-and/m-p/281968#M10693 <P>I have a bunch of forwarder machines that were inadvertently renamed recently. As a result, our forwarder manager no longer recognized the machines in the correct server class and apps were removed from the machine.</P> <P>One of the apps that was removed forwards data from a file. Since the app was uninstalled and later reinstalled, will the forwarder resend data from that file? Or will it still remember which line was last forwarded and just pick up where it left off?</P> Tue, 12 Apr 2016 16:55:46 GMT https://community.splunk.com/t5/Deployment-Architecture/How-does-Splunk-forwarder-handle-data-after-uninstalling-and/m-p/281968#M10693 bruceclarke 2016-04-12T16:55:46Z https://community.splunk.com/t5/Deployment-Architecture/How-does-Splunk-forwarder-handle-data-after-uninstalling-and/m-p/281969#M10694 <P>The "file pointer" that tracks how far Splunk has read the input file is stored in the "fishbucket." The fishbucket is stored with the indexes. Unless you have deleted or reset the fishbucket in some way, the forwarder should pick up where it left off in processing the input.</P> Tue, 12 Apr 2016 17:34:59 GMT https://community.splunk.com/t5/Deployment-Architecture/How-does-Splunk-forwarder-handle-data-after-uninstalling-and/m-p/281969#M10694 lguinn2 2016-04-12T17:34:59Z